8 stories, newest first · one card per story
Phishers deliver a legitimately signed ConnectWise ScreenConnect client preconfigured to call back to attacker infrastructure, bypassing malware detection for remote access.
Huntress reports attacker RMM abuse in 45% of Q1 2026 endpoint incidents, up 277% YoY, delivered via phishing lures stacking multiple remote-access tools.
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
Microsoft details a phishing campaign abusing signed MSP360 RMM installers to deploy ScreenConnect for persistent access and browser credential theft.
AgtaBackup RAT uses fake Microsoft Store pages and legitimate RMM tools to steal data from Windows systems.
Attackers abuse signed RMM tools via fake Microsoft Store pages to deploy new .NET spyware RAT AgtaBackup with keylogging and browser data theft.
Huntress details phishing campaigns installing rogue ITarian and ScreenConnect RMM clients with SYSTEM persistence, amid a 277% spike in RMM abuse.
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Today 1.6K readers · 2.5K views · 778 reads · all time 189K views